[BE-130] Validate uploaded document files by content, not declared type

[mftee]

Overview

The documents module accepts land ownership paperwork. A client-declared Content-Type and file extension are trivially spoofed, so neither can be trusted to decide what a file is.

This is distinct from the upload feature work already filed — this issue is specifically about validation and safe storage of whatever is uploaded.

Tasks

• Add a reusable upload validation pipe: maximum size, MIME allowlist, and magic-byte sniffing to confirm the actual file type.
• Reject archives, executables, and anything outside the allowlist regardless of extension.
• Generate randomized storage keys — never use the client-supplied filename as a path component (path traversal).
• Consider PDF-specific risks: pdf-lib and pdfkit are installed, and PDFs can embed active content. Sanitize or render rather than serving originals inline.
• Serve downloads with Content-Disposition: attachment and a correct Content-Type, never text/html.
• Strip metadata from uploaded images, which can carry GPS coordinates.
• Add tests for each rejection path.

Acceptance Criteria

• An executable renamed to .pdf is rejected by content inspection.
• Path traversal via a crafted filename is impossible (covered by a test).
• Downloads cannot be rendered inline as HTML.

Notes for Contributors

Comment below to be assigned.

[blessme247]

@blessme247 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @blessme247 to this issue.

[opeolarewaju5-glitch]

@opeolarewaju5-glitch has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello maintainer, I can fix this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @opeolarewaju5-glitch to this issue.

[adewaleomolara522-coder]

@adewaleomolara522-coder has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi Maintainer, I understand the problem and am confident I can provide a high quality fix, kindly assign this issue to me thanks

ℹ️ Repo Maintainers: To accept this application, review their application or assign @adewaleomolara522-coder to this issue.

[vincentchimene]

@vincentchimene has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi! I’d like to contribute to #989 – Validate uploaded document files by content, not declared type. I’m interested in improving the security of the document upload pipeline by implementing layered validation and safe file handling practices.

I can implement a reusable upload validation component that verifies files using magic-byte inspection alongside size limits and MIME allowlists, ensuring client-declared types and extensions are never trusted. I’ll also harden storage by using randomized object keys, prevent path traversal, improve PDF and image handling to reduce security and privacy risks, serve downloads with safe response headers, and add comprehensive tests covering all rejection paths and security edge cases.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @vincentchimene to this issue.

[veemakama]

@veemakama has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi, i would love to work on this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @veemakama to this issue.

[Mkalbani]

@Mkalbani has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi maintainers, can I work on this. I've worked on a similar work. Thank you.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Mkalbani to this issue.

[drips-wave]

Congratulations, @Mkalbani! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @Mkalbani: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊